I need some help understanding the configuration

[rail01]

Hello!

I've been experimenting a bit with Warpgate today and there are a few things about the way it behaves that confuse me, I wasn't able to find answers in the documentation either so I hope someone here will be able to help me.

In my setup, I want to run Warpgate in a Docker container and then expose it to the internet behind a reverse proxy (nginx). The first part was easy, the other one not so much. I did all the usual reverse proxy settings and made sure proxy headers are configured correctly, also set http.trust_x_forwarded_headers to true. But I have other issues.

In this situation I don't really want to configure TLS in Warpgate – all services in my homelab have their certificates and keys set up in nginx, which integrates with Certbot without any issues – nginx loads files on startup as root, so file permissions aren't an issue.

With Warpgate it's quite the opposite. I can't manage to sucessfully mount /etc/letsencrypt/live/.../ into the container due to insufficient permissions and I'd really rather avoid manually moving and changing permissions of certificates obtained by Certbot – that mostly defeats the purpose of externally managed automatically renewed certificates.

So how can I configure it to just stop being so pushy about TLS? Only unencrypted traffic happens between the container and nginx on the same server, it's really fine. It might not be ideal but it's way easier to manage the exact same way as all my other services and all the traffic outside my infrastructure is still encrypted so I wouldn't call this scenario horribly insecure 🤷

Additionally, I want Warpgate to bind to port let's say 8888 (both inside the container and on host OS), but then be exposed to the internet via nginx on default HTTPS port 443 – which is the default behavior of every single service i'm running except Warpgate, which very stubbornly wants to only accept connections on the listening port specified in its YAML config file, regardless of reverse proxy setup.

I tried setting http.external_port to 443 but it didn't change anything. It's not exactly clear to me what external_port config key is supposed to do then, the documentation about config file keys just doesn't seem to exist (or I'm really bad at looking, but I tried).

Warpgate looks like exactly the kind of a service I was looking for but I wish configuration for my use-case was more straightforward and the documentation was better tbh.

Config files

./data/warpgate.yaml

sso_providers: []
recordings:
    enable: true
    path: /data/recordings
external_host: example.com
database_url: 'sqlite:/data/db'
ssh:
    enable: false
http:
    listen: '[::]:8888'
    external_port: 443
    external_host: example.com
    certificate: /data/tls.certificate.pem
    key: /data/tls.key.pem
    trust_x_forwarded_headers: true
    session_max_age: 30m
    cookie_max_age: 1day
    sni_certificates: []
kubernetes:
    enable: false
mysql:
    enable: false
postgres:
    enable: false
log:
    retention: 7days
    audit_retention: 11months 30days 3h 50m 24s
    send_to: null
    format: text

./docker-compose.yaml

services:
    warpgate:
        image: ghcr.io/warp-tech/warpgate:latest
        container_name: warpgate
        restart: unless-stopped
        user: 1001:1001
        ports:
            - 8888:8888
        volumes:
            - ./data:/data
        stdin_open: true
        tty: true

nginx config

server {
        server_name example.com;

        location / {
                proxy_pass http://127.0.0.1:8888;

                proxy_set_header Host $http_host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
        }

        listen [::]:443 ssl;
        listen 443 ssl;

        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        include /etc/letsencrypt/options-ssl-nginx.conf;
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}
server {
        if ($host = example.com) {
                return 301 https://$host$request_uri;
        }

        listen 80;
        listen [::]:80;

        return 404;
}

[Eugeny]

There is no way to disable TLS in Warpgate, but you can simply let it use the automatically generated TLS certificate - you don't need trusted TLS between NGINX and its upstream on the same host.

Ports are also not an issue - keep http.listen: 0.0.0.0:8888 and http.external_port: 443 in the config and point NGINX at the host port that you've mapped to 8888 in the Warpgate container.

external_port only influences UI labels and redirect URLs in the cases where Warpgate cannot figure out its true external port based on the headers.

[Eugeny]

(NGINX needs proxy_pass https://...)

[rail01]

Ah! Okay yeah, it was mostly the http instead of https in proxy_pass that was giving me trouble. Thanks!

[rail01]

I have one more question then.

HTTP domain binding page in the docs mentions that using one specific subdomain for Warpgate and then subdomains within that subdomain for services behind it is recommended, but it should be possible to have Warpgate at one subdomain (for example auth.example.com) and then services on different unrelated subdomains within the same domain (e.g. gitlab.example.com) without constantly having to log back in as long as cookies are set with domain= parameter.

Is such configuration supported?

[Eugeny]

Yes, in theory you could set external_host: example.com, which controls the cookie's domain, and then manually set SSO return domain (if you have it) back to auth.example.com